CIS Controls v8.1

Das eigene veröffentlichte Crosswalk von CIS deckt 49 von 153 Safeguards ab. ControlMapping hat die übrigen redaktionell zugeordnet, mit einer Begründung für jede Zuordnung. Prüfen Sie diese Verknüpfungen daher, bevor Sie sich darauf verlassen.

Vergleiche

Anforderungen

Anforderungs-IDs und Titel werden so angezeigt, wie jedes Framework sie veröffentlicht, auf Englisch.

CIS Controls v8.1 Anforderungen

ID	Anforderung	Themen	Zugeordnet in
1. Inventory and Control of Enterprise Assets · 5
CIS 1.1	Establish and Maintain Detailed Enterprise Asset Inventory	Asset-Management	13 von 13
CIS 1.2	Address Unauthorized Assets	Asset-Management	13 von 13
CIS 1.3	Utilize an Active Discovery Tool	Asset-Management	13 von 13
CIS 1.4	Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory	Asset-Management	13 von 13
CIS 1.5	Use a Passive Asset Discovery Tool	Asset-Management	13 von 13
2. Inventory and Control of Software Assets · 7
CIS 2.1	Establish and Maintain a Software Inventory	Asset-Management	13 von 13
CIS 2.2	Ensure Authorized Software is Currently Supported	Patch-Management	10 von 13
CIS 2.3	Address Unauthorized Software	Asset-Management	13 von 13
CIS 2.4	Utilize Automated Software Inventory Tools	Asset-Management	13 von 13
CIS 2.5	Allowlist Authorized Software	Endpoint-Schutz	10 von 13
CIS 2.6	Allowlist Authorized Libraries	Endpoint-Schutz	10 von 13
CIS 2.7	Allowlist Authorized Scripts	Endpoint-Schutz	10 von 13
3. Data Protection · 14
CIS 3.1	Establish and Maintain a Data Management Process	Datenschutz	11 von 13
CIS 3.2	Establish and Maintain a Data Inventory	Datenklassifizierung	9 von 13
CIS 3.3	Configure Data Access Control Lists	Zugriffskontrolle	11 von 13
CIS 3.4	Enforce Data Retention	Datenschutz	11 von 13
CIS 3.5	Securely Dispose of Data	Datenschutz	11 von 13
CIS 3.6	Encrypt Data on End-User Devices	Verschlüsselung	10 von 13
CIS 3.7	Establish and Maintain a Data Classification Scheme	Datenklassifizierung	9 von 13
CIS 3.8	Document Data Flows	Datenklassifizierung	9 von 13
CIS 3.9	Encrypt Data on Removable Media	Verschlüsselung	10 von 13
CIS 3.10	Encrypt Sensitive Data in Transit	Verschlüsselung	10 von 13
CIS 3.11	Encrypt Sensitive Data at Rest	Verschlüsselung, Datenschutz	11 von 13
CIS 3.12	Segment Data Processing and Storage Based on Sensitivity	Datenschutz	11 von 13
CIS 3.13	Deploy a Data Loss Prevention Solution	DLP	7 von 13
CIS 3.14	Log Sensitive Data Access	Protokollierung & Audit	10 von 13
4. Secure Configuration of Enterprise Assets and Software · 12
CIS 4.1	Establish and Maintain a Secure Configuration Process	Sichere Konfiguration	9 von 13
CIS 4.2	Establish and Maintain a Secure Configuration Process for Network Infrastructure	Sichere Konfiguration	9 von 13
CIS 4.3	Configure Automatic Session Locking on Enterprise Assets	Sichere Konfiguration	9 von 13
CIS 4.4	Implement and Manage a Firewall on Servers	Firewall / Netzsegmentierung	9 von 13
CIS 4.5	Implement and Manage a Firewall on End-User Devices	Firewall / Netzsegmentierung	9 von 13
CIS 4.6	Securely Manage Enterprise Assets and Software	Sichere Konfiguration	9 von 13
CIS 4.7	Manage Default Accounts on Enterprise Assets and Software	Sichere Konfiguration	9 von 13
CIS 4.8	Uninstall or Disable Unnecessary Services on Enterprise Assets and Software	Sichere Konfiguration	9 von 13
CIS 4.9	Configure Trusted DNS Servers on Enterprise Assets	DNS-Sicherheit	3 von 13
CIS 4.10	Enforce Automatic Device Lockout on Portable End-User Devices	Mobile Security	7 von 13
CIS 4.11	Enforce Remote Wipe Capability on Portable End-User Devices	Mobile Security	7 von 13
CIS 4.12	Separate Enterprise Workspaces on Mobile End-User Devices	Mobile Security	7 von 13
5. Account Management · 6
CIS 5.1	Establish and Maintain an Inventory of Accounts	Zugriffskontrolle	11 von 13
CIS 5.2	Use Unique Passwords	Zugriffskontrolle	11 von 13
CIS 5.3	Disable Dormant Accounts	Zugriffskontrolle	11 von 13
CIS 5.4	Restrict Administrator Privileges to Dedicated Administrator Accounts	Privilegierter Zugriff	10 von 13
CIS 5.5	Establish and Maintain an Inventory of Service Accounts	Zugriffskontrolle	11 von 13
CIS 5.6	Centralize Account Management	Zugriffskontrolle	11 von 13
6. Access Control Management · 8
CIS 6.1	Establish an Access Granting Process	Zugriffskontrolle	11 von 13
CIS 6.2	Establish an Access Revoking Process	Zugriffskontrolle	11 von 13
CIS 6.3	Require MFA for Externally-Exposed Applications	Multi-Faktor-Authentifizierung	10 von 13
CIS 6.4	Require MFA for Remote Network Access	Multi-Faktor-Authentifizierung	10 von 13
CIS 6.5	Require MFA for Administrative Access	Multi-Faktor-Authentifizierung	10 von 13
CIS 6.6	Establish and Maintain an Inventory of Authentication and Authorization Systems	Zugriffskontrolle	11 von 13
CIS 6.7	Centralize Access Control	Zugriffskontrolle	11 von 13
CIS 6.8	Define and Maintain Role-Based Access Control	Zugriffskontrolle, Zero Trust	11 von 13
7. Continuous Vulnerability Management · 7
CIS 7.1	Establish and Maintain a Vulnerability Management Process	Schwachstellenmanagement	13 von 13
CIS 7.2	Establish and Maintain a Remediation Process	Schwachstellenmanagement	13 von 13
CIS 7.3	Perform Automated Operating System Patch Management	Patch-Management	10 von 13
CIS 7.4	Perform Automated Application Patch Management	Patch-Management	10 von 13
CIS 7.5	Perform Automated Vulnerability Scans of Internal Enterprise Assets	Schwachstellenmanagement	13 von 13
CIS 7.6	Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets	Schwachstellenmanagement	13 von 13
CIS 7.7	Remediate Detected Vulnerabilities	Schwachstellenmanagement	13 von 13
8. Audit Log Management · 12
CIS 8.1	Establish and Maintain an Audit Log Management Process	Protokollierung & Audit	10 von 13
CIS 8.2	Collect Audit Logs	Protokollierung & Audit	10 von 13
CIS 8.3	Ensure Adequate Audit Log Storage	Protokollierung & Audit	10 von 13
CIS 8.4	Standardize Time Synchronization	Protokollierung & Audit	10 von 13
CIS 8.5	Collect Detailed Audit Logs	Protokollierung & Audit	10 von 13
CIS 8.6	Collect DNS Query Audit Logs	DNS-Sicherheit	3 von 13
CIS 8.7	Collect URL Request Audit Logs	Protokollierung & Audit	10 von 13
CIS 8.8	Collect Command-Line Audit Logs	Protokollierung & Audit	10 von 13
CIS 8.9	Centralize Audit Logs	SIEM / SOC	10 von 13
CIS 8.10	Retain Audit Logs	Protokollierung & Audit	10 von 13
CIS 8.11	Conduct Audit Log Reviews	Anomalieerkennung	9 von 13
CIS 8.12	Collect Service Provider Logs	Protokollierung & Audit	10 von 13
9. Email and Web Browser Protections · 7
CIS 9.1	Ensure Use of Only Fully Supported Browsers and Email Clients	E-Mail-Sicherheit	8 von 13
CIS 9.2	Use DNS Filtering Services	DNS-Sicherheit	3 von 13
CIS 9.3	Maintain and Enforce Network-Based URL Filters	Webanwendungssicherheit	6 von 13
CIS 9.4	Restrict Unnecessary or Unauthorized Browser and Email Client Extensions	E-Mail-Sicherheit	8 von 13
CIS 9.5	Implement DMARC	E-Mail-Sicherheit	8 von 13
CIS 9.6	Block Unnecessary File Types	E-Mail-Sicherheit	8 von 13
CIS 9.7	Deploy and Maintain Email Server Anti-Malware Protections	E-Mail-Sicherheit	8 von 13
10. Malware Defenses · 7
CIS 10.1	Deploy and Maintain Anti-Malware Software	Endpoint-Schutz	10 von 13
CIS 10.2	Configure Automatic Anti-Malware Signature Updates	Endpoint-Schutz	10 von 13
CIS 10.3	Disable Autorun and Autoplay for Removable Media	Endpoint-Schutz	10 von 13
CIS 10.4	Configure Automatic Anti-Malware Scanning of Removable Media	Endpoint-Schutz	10 von 13
CIS 10.5	Enable Anti-Exploitation Features	Endpoint-Schutz	10 von 13
CIS 10.6	Centrally Manage Anti-Malware Software	Endpoint-Schutz	10 von 13
CIS 10.7	Use Behavior-Based Anti-Malware Software	Endpoint-Schutz	10 von 13
11. Data Recovery · 5
CIS 11.1	Establish and Maintain a Data Recovery Process	Wiederherstellungsplanung, Disaster Recovery	10 von 13
CIS 11.2	Perform Automated Backups	Backup & Recovery	11 von 13
CIS 11.3	Protect Recovery Data	Backup & Recovery	11 von 13
CIS 11.4	Establish and Maintain an Isolated Instance of Recovery Data	Backup & Recovery	11 von 13
CIS 11.5	Test Data Recovery	Backup & Recovery	11 von 13
12. Network Infrastructure Management · 8
CIS 12.1	Ensure Network Infrastructure is Up-to-Date	Patch-Management	10 von 13
CIS 12.2	Establish and Maintain a Secure Network Architecture	Firewall / Netzsegmentierung, Zero Trust	9 von 13
CIS 12.3	Securely Manage Network Infrastructure	Firewall / Netzsegmentierung	9 von 13
CIS 12.4	Establish and Maintain Architecture Diagram(s)	Firewall / Netzsegmentierung	9 von 13
CIS 12.5	Centralize Network Authentication, Authorization, and Auditing (AAA)	Zugriffskontrolle	11 von 13
CIS 12.6	Use of Secure Network Management and Communication Protocols	Firewall / Netzsegmentierung	9 von 13
CIS 12.7	Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure	Zero Trust	7 von 13
CIS 12.8	Establish and Maintain Dedicated Computing Resources for All Administrative Work	Privilegierter Zugriff	10 von 13
13. Network Monitoring and Defense · 11
CIS 13.1	Centralize Security Event Alerting	Kont. Überwachung, SIEM / SOC	10 von 13
CIS 13.2	Deploy a Host-Based Intrusion Detection Solution	Angriffserkennung	9 von 13
CIS 13.3	Deploy a Network Intrusion Detection Solution	Angriffserkennung	9 von 13
CIS 13.4	Perform Traffic Filtering Between Network Segments	Firewall / Netzsegmentierung	9 von 13
CIS 13.5	Manage Access Control for Remote Assets	Zero Trust	7 von 13
CIS 13.6	Collect Network Traffic Flow Logs	Kont. Überwachung	10 von 13
CIS 13.7	Deploy a Host-Based Intrusion Prevention Solution	Angriffserkennung	9 von 13
CIS 13.8	Deploy a Network Intrusion Prevention Solution	Angriffserkennung	9 von 13
CIS 13.9	Deploy Port-Level Access Control	Firewall / Netzsegmentierung	9 von 13
CIS 13.10	Perform Application Layer Filtering	Webanwendungssicherheit, WAF	6 von 13
CIS 13.11	Tune Security Event Alerting Thresholds	SIEM / SOC	10 von 13
14. Security Awareness and Skills Training · 9
CIS 14.1	Establish and Maintain a Security Awareness Program	Awareness & Training	10 von 13
CIS 14.2	Train Workforce Members to Recognize Social Engineering Attacks	Awareness & Training	10 von 13
CIS 14.3	Train Workforce Members on Authentication Best Practices	Awareness & Training	10 von 13
CIS 14.4	Train Workforce on Data Handling Best Practices	Awareness & Training	10 von 13
CIS 14.5	Train Workforce Members on Causes of Unintentional Data Exposure	Awareness & Training	10 von 13
CIS 14.6	Train Workforce Members on Recognizing and Reporting Security Incidents	Awareness & Training	10 von 13
CIS 14.7	Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates	Awareness & Training	10 von 13
CIS 14.8	Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks	Awareness & Training	10 von 13
CIS 14.9	Conduct Role-Specific Security Awareness and Skills Training	Awareness & Training	10 von 13
15. Service Provider Management · 7
CIS 15.1	Establish and Maintain an Inventory of Service Providers	Cloud-Sicherheit, Lieferantenrisikomanagement	12 von 13
CIS 15.2	Establish and Maintain a Service Provider Management Policy	Lieferkettenrisiko	9 von 13
CIS 15.3	Classify Service Providers	Lieferantenrisikomanagement	10 von 13
CIS 15.4	Ensure Service Provider Contracts Include Security Requirements	Lieferantenrisikomanagement	10 von 13
CIS 15.5	Assess Service Providers	Lieferantenrisikomanagement	10 von 13
CIS 15.6	Monitor Service Providers	Lieferantenrisikomanagement	10 von 13
CIS 15.7	Securely Decommission Service Providers	Lieferantenrisikomanagement	10 von 13
16. Application Software Security · 14
CIS 16.1	Establish and Maintain a Secure Application Development Process	Sichere Entwicklung	8 von 13
CIS 16.2	Establish and Maintain a Process to Accept and Address Software Vulnerabilities	Sichere Entwicklung	8 von 13
CIS 16.3	Perform Root Cause Analysis on Security Vulnerabilities	Sichere Entwicklung	8 von 13
CIS 16.4	Establish and Manage an Inventory of Third-Party Software Components	Asset-Management	13 von 13
CIS 16.5	Use Up-to-Date and Trusted Third-Party Software Components	Sichere Entwicklung	8 von 13
CIS 16.6	Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities	Schwachstellenmanagement	13 von 13
CIS 16.7	Use Standard Hardening Configuration Templates for Application Infrastructure	Sichere Konfiguration	9 von 13
CIS 16.8	Separate Production and Non-Production Systems	Sichere Entwicklung	8 von 13
CIS 16.9	Train Developers in Application Security Concepts and Secure Coding	Sichere Entwicklung	8 von 13
CIS 16.10	Apply Secure Design Principles in Application Architectures	Webanwendungssicherheit, API-Sicherheit	6 von 13
CIS 16.11	Leverage Vetted Modules or Services for Application Security Components	Sichere Entwicklung	8 von 13
CIS 16.12	Implement Code-Level Security Checks	Sichere Entwicklung, API-Sicherheit	8 von 13
CIS 16.13	Conduct Application Penetration Testing	Sichere Entwicklung	8 von 13
CIS 16.14	Conduct Threat Modeling	Sichere Entwicklung	8 von 13
17. Incident Response Management · 9
CIS 17.1	Designate Personnel to Manage Incident Handling	Incident Response	12 von 13
CIS 17.2	Establish and Maintain Contact Information for Reporting Security Incidents	Kommunikation	8 von 13
CIS 17.3	Establish and Maintain an Enterprise Process for Reporting Incidents	Meldung	12 von 13
CIS 17.4	Establish and Maintain an Incident Response Process	Incident Response	12 von 13
CIS 17.5	Assign Key Roles and Responsibilities	Incident Response	12 von 13
CIS 17.6	Define Mechanisms for Communicating During Incident Response	Kommunikation, Kommunikation & Wiederherstellung	9 von 13
CIS 17.7	Conduct Routine Incident Response Exercises	Incident Response	12 von 13
CIS 17.8	Conduct Post-Incident Reviews	Erkenntnisse aus Vorfällen	9 von 13
CIS 17.9	Establish and Maintain Security Incident Thresholds	Incident Response	12 von 13
18. Penetration Testing · 5
CIS 18.1	Establish and Maintain a Penetration Testing Program	Schwachstellenmanagement	13 von 13
CIS 18.2	Perform Periodic External Penetration Tests	Schwachstellenmanagement	13 von 13
CIS 18.3	Remediate Penetration Test Findings	Schwachstellenmanagement	13 von 13
CIS 18.4	Validate Security Measures	Schwachstellenmanagement	13 von 13
CIS 18.5	Perform Periodic Internal Penetration Tests	Schwachstellenmanagement	13 von 13

Themenabdeckung

Themen mit zugeordneten CIS v8.1-Anforderungen (38):

Keine Zuordnung in unseren Daten Keine CIS v8.1-Anforderung (12):